#1110695 RM: vault/experimental -- RoQA; no upload since 2020, upstream relicensing, fork of hashicorp vault might be packaged, has security issues

#1110695#5
Date:
2025-08-10 06:43:47 UTC
From:
To:
Hi

src:vault was ever only uploaded to experimental, but upstream project
has later on be relicensed under a non-free license. A fork of the
project exists, openbao, itp'ed as #1069794. Furthermore HashiCorp
Vault has several upstream security issues which then cannot be fixed
in this older version.

Please remove it as well from experimental and let' see if openbao
will come to flight for forky.

Regards,
Salvatore

#1110695#12
Date:
2025-08-13 09:25:25 UTC
From:
To:
We believe that the bug you reported is now fixed; the following
package(s) have been removed from experimental:

     vault | 1.0.2+dfsg2-3 | source, armhf
     vault | 1.0.2+dfsg2-5 | source, amd64, arm64, i386, ppc64el, s390x
------------------- Reason ------------------- RoQA; no upload since 2020, upstream relicensing, fork of hashicorp vault might be packaged, has security issues ---------------------------------------------- Note that the package(s) have simply been removed from the tag database and may (or may not) still be in the pool; this is not a bug. The package(s) will be physically removed automatically when no suite references them (and in the case of source, when no binary references it). Please also remember that the changes have been done on the master archive and will not propagate to any mirrors until the next dinstall run at the earliest. Packages are usually not removed from testing by hand. Testing tracks unstable and will automatically remove packages which were removed from unstable when removing them from testing causes no dependency problems. The release team can force a removal from testing if it is really needed, please contact them if this should be the case. Bugs which have been reported against this package are not automatically removed from the Bug Tracking System. Please check all open bugs and close them or re-assign them to another package if the removed package was superseded by another one. The version of this package that was in Debian prior to this removal can still be found using https://snapshot.debian.org/. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1110695@bugs.debian.org. The full log for this bug can be viewed at https://bugs.debian.org/1110695 This message was generated automatically; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org. Debian distribution maintenance software pp. Thorsten Alteholz (the ftpmaster behind the curtain)